Role in IT decision-making process:Align Business & IT GoalsCreate IT StrategyDetermine IT NeedsManage Vendor RelationshipsEvaluate/Specify Brands or VendorsOther RoleAuthorize PurchasesNot Involved

Work Phone:

Company:

Company Size:

Industry:

Street Address

City:

Zip/postal code

State/Province:

Country:

Occasionally, we send subscribers special offers from select partners. Would you like to receive these special partner offers via e-mail?YesNo

Your registration with Eweek will include the following free email newsletter(s):News & Views

By submitting your wireless number, you agree that eWEEK, its related properties, and vendor partners providing content you view may contact you using contact center technology. Your consent is not required to view content or use site features.

By clicking on the "Register" button below, I agree that I have carefully read the Terms of Service and the Privacy Policy and I agree to be legally bound by all such terms.

Google Patches Android for 90 Vulnerabilities in January Update

Google starts the new year with another large security update for Android, once again patching mediaserver, Qualcomm and Linux kernel vulnerabilities.

Android is starting 2017 much the same way it ended 2016, with a large security patch update. Google released the first Android patch update of 2017 on Jan. 4, providing fixes for 90 identified vulnerabilities. Of those, 29 are rated as being critical, 41 as high and 20 are ranked as having moderate severity.

The January update is an increase in patch volume from the December Android update which patched 74 vulnerabilities and significantly larger than the first Android update of 2016, which only patched 12 vulnerabilities.

While the January 2017 update is large, on a positive note, Google stated that it has had no reports of active customer exploitation or abuse of these newly reported issues.

Among the 29 critical issues is one in Google's much maligned mediaserver component. Since the first of Google's monthly Android security updates that began in August 2015, there have been monthly patches for mediaserver-related flaws including the stagefright media library. The new CVE-2017-0381 vulnerability is a remote code execution vulnerability in mediaserver that was reported to Google by Trend Micro.

Further reading

"A remote code execution vulnerability in mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing," Google warns in its advisory.

Thera are also seven additional non-critical flaws in mediaserver that Google is patching in the January update. Among them are four Denial of Service vulnerabilities (CVE-2017-0390, CVE-2017-0391, CVE-2017-0392 and CVE-2017-0393), two information disclosure vulnerabilities (CVE-2017-0396 and CVE-2017-0397) and a single privilege escalation flaw (CVE-2017-0387).

As has been the case in recent Android updates, Qualcomm components are also well represented in the list of critical vulnerabilities. In total, there are 24 different Qualcomm vulnerabilities patched in the January update. Of those 13 are rated as critical, seven are rated as high and four have moderate severity.

NVIDIA drivers are once again on the list of critical flaws being patched. This month Google is providing patches for 12 critical vulnerabilities in NVIDIA Android driver components, which is double the six critical NVIDA flaws that were patched in the December Android update.

Google's January Android security update also deals with older vulnerabilities that have already been patched in the upstream Linux kernel. Among them is the critical CVE-2015-3288 kernel privilege escalation vulnerability that was was first patched in the Linux kernel back on Jul. 9, 2015. Another older Linux flaw that is now being patched in Android is the critical CVE-2015-5706 privilege vulnerability in the kernel filesystem, which was first patched in the upstream Linux kernel on May 9, 2015.

Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.

By submitting your information, you agree that eweek.com may send you eWEEK offers via email, phone and text message, as well as email offers about other products and services that eWEEK believes may be of interest to you. eWEEK will process your information in accordance with the Quinstreet Privacy Policy.

We ran into a problem

We already have your email address on file. Please use the "Forgot your password?" link to create a password, validate your email and login.